[Webkit-unassigned] [Bug 9429] New: Assertion fails in HTMLInputRenderer::setValueFromRenderer after deleting text

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=9429

           Summary: Assertion fails in
                    HTMLInputRenderer::setValueFromRenderer after deleting
                    text
           Product: WebKit
           Version: 420+ (nightly)
          Platform: Macintosh
               URL: http://mapquest.com
        OS/Version: Mac OS X 10.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Forms
        AssignedTo: webkit-unassigned at opendarwin.org
        ReportedBy: sullivan at apple.com


To reproduce:

1. Visit http://mapquest.com -- the insertion point is in an address field
2. type one character (or more)
3. backspace over the typed text

This hits:

    ASSERT(value == constrainValue(value));

in HTMLInputElement::setValueFromRenderer

Partial backtrace is:

#0  0x01d9de90 in WebCore::HTMLInputElement::setValueFromRenderer
(this=0x28ea5eb0, value=@0xbfffe410) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/html/HTMLInputElement.cpp:1068
#1  0x01eec444 in WebCore::RenderTextField::subtreeHasChanged (this=0x28ea617c)
at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/rendering/RenderTextField.cpp:239
#2  0x01f921c4 in WebCore::HTMLTextFieldInnerElement::defaultEventHandler
(this=0x28ea6230, evt=0x29199780) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/html/HTMLTextFieldInnerElement.cpp:56
#3  0x01f952a8 in WebCore::EventTargetNode::dispatchGenericEvent
(this=0x28ea6230, e=@0xbfffe568, tempEvent=true) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/dom/EventTargetNode.cpp:249
#4  0x01f95b48 in WebCore::EventTargetNode::dispatchEvent (this=0x28ea6230,
e=@0xbfffe5c8, ec=@0xbfffe5cc, tempEvent=true) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/dom/EventTargetNode.cpp:282
#5  0x01dc055c in WebCore::dispatchEditableContentChangedEvent
(root=0x28ea6230) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/page/Frame.cpp:2026
#6  0x01dc09c4 in WebCore::Frame::appliedEditing (this=0x1395e730,
cmd=@0xbfffe708) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/page/Frame.cpp:2035
#7  0x01f5bc1c in WebCore::TypingCommand::typingAddedToOpenCommand
(this=0x291985a0) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:246
#8  0x01f5c094 in WebCore::TypingCommand::deleteKeyPressed (this=0x291985a0) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:346
#9  0x01f5c9b0 in WebCore::TypingCommand::deleteKeyPressed
(document=0x140c0c00, smartDelete=false) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/editing/TypingCommand.cpp:64
#10 0x01e010a4 in -[WebCoreFrameBridge deleteKeyPressedWithSmartDelete:]
(self=0x1395f0f0, _cmd=0x12ff9dc, smartDelete=0 '\0') at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebCore/bridge/mac/WebCoreFrameBridge.mm:2160
#11 0x01260eac in -[WebHTMLView(WebHTMLViewFileInternal)
_deleteRange:killRing:prepend:smartDeleteOK:deletionAction:] (self=0x139f77a0,
_cmd=0x12ff1dc, range=0x291cae10, killRing=0 '\0', prepend=0 '\0',
smartDeleteOK=0 '\0', deletionAction=deleteKeyAction) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:606
#12 0x0127a2dc in -[WebHTMLView
_deleteWithDirection:granularity:killRing:isTypingAction:] (self=0x139f77a0,
_cmd=0x12fda00, direction=WebBridgeSelectBackward,
granularity=WebBridgeSelectByCharacter, killRing=0 '\0', isTypingAction=1
'\001') at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:4540
#13 0x0127a40c in -[WebHTMLView deleteBackward:] (self=0x139f77a0,
_cmd=0x90a94df0, sender=0x0) at
/Volumes/Big/johnsullivan/Projects/Labyrinth/OpenSource/WebKit/WebView/WebHTMLView.m:4555
<...>

Not sure if this more of a Forms problem or more of an HTML editing problem. I
haven't tried it on a release build so I don't know if there are symptoms
beyond the assertion failure.


-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.